Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.

What to know

What it is

A Subscriber PHP Object Injection vulnerability exists in BuddyPress Xprofile Custom Field Types versions up to 1.3.1. An attacker could exploit this to gain high-level privileges, including the ability to inject malicious code.

Affected

{'products': ['BuddyPress'], 'packages': ['BuddyPress Xprofile Custom Field Types'], 'versions': ['<= 1.3.1']}

Fix

Check the linked advisory for the concrete fix.

Exploitation

No known exploitation